repository·master·Indexed 25 days ago
https://github.com/guyinatuxedo/nightmareAn educational course on binary exploitation and reverse engineering using CTF challenges and write-ups. The course covers x86 and x64 assembly architecture, Intel syntax, register usage, stack management, and debugging with gdb-gef. It includes practical guides on disassembling binaries with objdump and identifying common assembly patterns such as loops and conditional logic.
The heap_golf challenge requires printing the contents of flag.txt rather than obtaining a shell. The target binary heap_golf1 is a 64-bit ELF executable with the following security properties:
0x400000)magicheap challenge is a heap exploitation exercise targeting libc-2.23.so. The goal is to trigger the l33t() function, which executes system("cat ./flag"), by manipulating a global variable named magic located at 0x6020c0 to a value $\ge$ 0x1306 (decimal 4869).The auth binary is a 64-bit ELF executable used for a heap grooming exploitation challenge. It features a command-line interface that manages user sessions and authorization levels.
Security Protections:
Available Commands:
show: Displays current user and authorization level.login [name]: Logs in as the specified name.set-auth [level]: Sets authorization level (must be < 5).get-flag: Prints the flag (requires authorization level 5).reset: Logs out and resets authorization level.quit: Exits the program.The stackstuff challenge is a binary exploitation task where the objective is to read the contents of the flag file. The target is a 64-bit ELF executable with the following security properties:
Note that while the binary does not produce immediate output upon execution, it binds to a network port (e.g., 1514) which can be identified using netstat.
$ file stackstuff
stackstuff: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=f46fbf9b159f6a1a31893faf7f771ca186a2ce8d, not stripped
$ pwn checksec stackstuff
[*] '/Hackery/pod/modules/partial_overwrite/hacklu15_stackstuff/stackstuff'
Arch: amd64-64-little
RELRO: No RELRO
Stack: No canary found
NX: NX enabled
PIE: PIE enabledNightmare is a course focused on Binary Exploitation and Reverse Engineering using CTF (Capture The Flag) challenges.
An uninitialized variable is a variable that is declared but not assigned a value. In C, an uninitialized variable inherits the value of whatever was previously stored at that specific memory location.
If a function declares and initializes a variable, and a subsequent function call uses the same memory address for a new (uninitialized) variable, the new variable will contain the old value. This behavior can be exploited in security contexts (e.g., during reads or comparisons) or can lead to unpredictable logic bugs.
#include <stdio.h>
void trashed(void)
{
int x = 0xfacade;
printf("Integer 0 Declared at:\t%p\n", &x);
printf("Integer 0 Value:\t\t0x%x\n\n", x);
}
void scatterd(void)
{
int y;
printf("Integer 1 Declared at:\t%p\n", &y);
printf("Integer 1 Value:\t\t0x%x\n\n", y);
if (y == 0xfacade)
{
puts("Play your game, and walk away.\n");
}
}
int main()
{
// ... execution flow ...
trashed();
scatterd();
}Assembly code is the low-level code executed directly by the processor. This guide focuses on Intel syntax.
Key architectures covered:
To visualize high-level code (like C) as assembly, you can use a decompiler such as Ghidra.
The popping_caps binary is an ELF 64-bit LSB shared object running on amd64. It uses libc 2.27 (Ubuntu GLIBC 2.27-3ubuntu1), which supports tcache.
Security Mitigations:
Key Features:
system) upon startup.bye() function calls malloc(0x38) before exiting.$ pwn checksec popping_caps
[*] '/Hackery/pod/modules/44-more_tcache/csaw19_popping_caps1/popping_caps'
Arch: amd64-64-little
RELRO: No RELRO
Stack: Canary found
NX: NX enabled
PIE: PIE enabled
$ file popping_caps
popping_caps: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=0b94b47318011a2516372524e7aaa0caeda06c79, not strippedThe H3 Machine is a 16-bit stack machine with no general-purpose registers. It operates on 32-bit words and has 1 MiB of total memory (2^16 word-addressed 32-bit words).
Special-Purpose Registers (16-bit):
IP: Instruction PointerSP: Stack PointerFR: Flag RegisterFlag Register (FR) Bits:
0x0001: Zero flag (set when 0x00000000 is pushed; cleared otherwise).0x0002: Carry flag (set on arithmetic overflow; cleared otherwise).0x8000: Flag flag (set when the top value of the stack at HALT is considered the flag).Memory & Loading:
0x0000 should contain 0x00000000 by convention.IP is initialized to 0x0001, SP and FR to 0x0000.The stkof binary is a 64-bit ELF executable with the following security configurations:
amd64-64-littlePartial RELROCanary foundNX enabledNo PIE (0x400000)It uses libc-2.23.so (Ubuntu GLIBC 2.23-0ubuntu11).
The sum binary is a 64-bit ELF executable with the following security configurations:
amd64-64-littlePartial RELROCanary foundNX enabledNo PIE (0x400000)It uses libc.so from Ubuntu GLIBC 2.27-3ubuntu1.
Behavioral observation: The program accepts a sequence of integers. A 0 terminates the sequence. Inputting 6 integers causes a segmentation fault, suggesting a potential buffer overflow or stack corruption.
$ pwn checksec sum_ccafa40ee6a5a675341787636292bf3c84d17264
[*] '/home/guyinatuxedo/Desktop/seccon/sum/sum_ccafa40ee6a5a675341787636292bf3c84d17264'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x400000)